Verify a decision

{"actor":"system:backfill","investigation_id":"05cd7768-ea55-47f0-a1ae-da562e54f3a7","kind":"publish","page_slug":"thorchain-dex","published_at":"2026-05-28T17:55:14.895Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Thorchain DEX","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://cointelegraph.com/magazine/thorchain-founder-jp-thor-vampire-attack-defi/","type":"other","url":""},{"credibility":3,"name":"https://www.technologyreview.com/2026/02/18/1132587/jean-paul-thorbjornsen-dark-side-crypto-permissionless-dream/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.coindesk.com/markets/2021/07/23/blockchain-protocol-thorchain-suffers-8m-hack","type":"other","url":""},{"credibility":3,"name":"https://www.theblock.co/post/111660/thorchain-suffers-5-million-exploit-developers-have-put-out-a-fix","type":"other","url":""},{"credibility":3,"name":"https://www.theblock.co/post/112308/thorchain-suffers-8-million-loss-by-hacker-wanting-to-teach-lesson","type":"other","url":""},{"credibility":3,"name":"https://medium.com/thorchain/post-mortem-eth-router-exploits-1-2-and-premature-return-to-trading-incident-2908928c5fb","type":"other","url":""},{"credibility":3,"name":"https://www.halborn.com/blog/post/explained-the-thorchain-hack-july-2021","type":"other","url":""},{"credibility":3,"name":"https://slowmist.medium.com/slowmist-analysis-of-three-consecutive-attacks-on-thorchain-6223f1c691be","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://decrypt.co/302688/defi-network-thorchain-200-million-debt-whats-going-on","type":"other","url":""},{"credibility":3,"name":"https://crypto.news/thorchain-in-massive-200m-debt-pauses-network-for-restructuring-votes/","type":"other","url":""},{"credibility":3,"name":"https://www.ccn.com/news/crypto/thorchain-bitcoin-ether-insolvency/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://chainwire.org/2025/05/19/thorchain-faces-legal-action-over-200m-collapse-amid-alleged-mismanagement-and-insolvency/","type":"other","url":""},{"credibility":3,"name":"https://cryptoslate.com/press-releases/thorchain-faces-legal-action-over-200m-collapse-amid-alleged-mismanagement-and-insolvency/","type":"other","url":""},{"credibility":3,"name":"https://www.thorchainlawsuit.com/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.coindesk.com/tech/2025/04/07/the-blockchain-fueling-north-korea-s-massive-crypto-laundering-operation","type":"other","url":""},{"credibility":3,"name":"https://www.dlnews.com/articles/defi/thorchain-role-in-lazarus-laundering-is-big-defi-problem/","type":"other","url":""},{"credibility":3,"name":"https://www.dlnews.com/articles/defi/lazarus-laundering-spree-threatens-chainflip-and-thorchain/","type":"other","url":""},{"credibility":3,"name":"https://cryptobriefing.com/lazarus-group-exploits-thorchain-for-292m-rseth-laundering-operation/","type":"other","url":""},{"credibility":3,"name":"https://cryptonews.com/news/bybit-hacker-launders-270k-eth-via-thorchain-still-holds-514m/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.trmlabs.com/resources/blog/thorchain-exploit-drains-usd-11m-across-at-least-nine-chains-what-trm-knows-now","type":"other","url":""},{"credibility":3,"name":"https://www.cryptotimes.io/2026/05/17/10-8-million-drained-inside-the-thorchain-exploit-that-froze-cross-chain-defi-for-13-hours/","type":"other","url":""},{"credibility":3,"name":"https://www.cryptotimes.io/2026/05/21/thorchain-shares-exploit-report-revealing-10-7m-vault-breach-by-new-node/","type":"other","url":""},{"credibility":3,"name":"https://cointelegraph.com/news/thorchain-halts-trading-zachxbt-flags-10m-exploit","type":"other","url":""},{"credibility":3,"name":"https://www.coindesk.com/tech/2026/05/15/thorchain-halts-trading-after-usd10-million-cross-chain-exploit-rune-token-drops-12","type":"other","url":""},{"credibility":3,"name":"https://crypto.news/thorchain-offers-hacker-bounty-as-restart-vote-opens/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://cryptonews.com/news/thorchain-co-founders-wallet-drained-1-35m-in-dprk-telegram-scam/","type":"other","url":""},{"credibility":3,"name":"https://coinnews.com/news/north-korean-hackers-stole-1-3m-from-thorchain-co-founders-wallet-zachxbt-says-its-poetic/","type":"other","url":""},{"credibility":3,"name":"https://beincrypto.com/north-korea-hack-thorchain-founder-1-3-million/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.thecryptoupdates.com/thorchain-faces-insolvency-claims-amid-26-price-drop-a-lesson/","type":"other","url":""},{"credibility":3,"name":"https://www.tronweekly.com/thorchain-hack-drains-10m-as-rune-drops-10/","type":"other","url":""}]}],"sources_used":[{"credibility":1,"name":"CoinDesk: Blockchain Protocol Thorchain Suffers $8M Hack","type":"news_article","url":"https://www.coindesk.com/markets/2021/07/23/blockchain-protocol-thorchain-suffers-8m-hack"},{"credibility":1,"name":"The Block: Thorchain suffers $5 million exploit","type":"news_article","url":"https://www.theblock.co/post/111660/thorchain-suffers-5-million-exploit-developers-have-put-out-a-fix"},{"credibility":1,"name":"The Block: Thorchain suffers another $8 million loss","type":"news_article","url":"https://www.theblock.co/post/112308/thorchain-suffers-8-million-loss-by-hacker-wanting-to-teach-lesson"},{"credibility":2,"name":"THORChain Medium: Post-mortem ETH Router Exploits 1 & 2","type":"official","url":"https://medium.com/thorchain/post-mortem-eth-router-exploits-1-2-and-premature-return-to-trading-incident-2908928c5fb"},{"credibility":2,"name":"Halborn: Explained: The THORChain Hack (July 2021)","type":"research","url":"https://www.halborn.com/blog/post/explained-the-thorchain-hack-july-2021"},{"credibility":2,"name":"SlowMist: Analysis of Three Consecutive Attacks on THORChain","type":"research","url":"https://slowmist.medium.com/slowmist-analysis-of-three-consecutive-attacks-on-thorchain-6223f1c691be"},{"credibility":2,"name":"Decrypt: DeFi Network Thorchain Faces $200 Million in Toxic Debt","type":"news_article","url":"https://decrypt.co/302688/defi-network-thorchain-200-million-debt-whats-going-on"},{"credibility":1,"name":"Blockworks: THORChain halts withdrawals amid $200M insolvency","type":"news_article","url":"https://blockworks.co/news/thorchain-halts-withdrawals-insolvency"},{"credibility":1,"name":"CoinDesk: Inside North Korea's Favorite Crypto Laundering Tool: THORChain","type":"news_article","url":"https://www.coindesk.com/tech/2025/04/07/the-blockchain-fueling-north-korea-s-massive-crypto-laundering-operation"},{"credibility":2,"name":"DL News: Thorchain watched Lazarus launder $900m in stolen crypto","type":"news_article","url":"https://www.dlnews.com/articles/defi/thorchain-role-in-lazarus-laundering-is-big-defi-problem/"},{"credibility":2,"name":"CryptoSlate: THORChain Faces Legal Action Over $200M Collapse","type":"news_article","url":"https://cryptoslate.com/press-releases/thorchain-faces-legal-action-over-200m-collapse-amid-alleged-mismanagement-and-insolvency/"},{"credibility":2,"name":"Chainwire: THORChain Faces Legal Action Over $200M Collapse","type":"news_article","url":"https://chainwire.org/2025/05/19/thorchain-faces-legal-action-over-200m-collapse-amid-alleged-mismanagement-and-insolvency/"},{"credibility":1,"name":"TRM Labs: THORChain Exploit Drains USD 11M+ Across at Least Nine Chains","type":"research","url":"https://www.trmlabs.com/resources/blog/thorchain-exploit-drains-usd-11m-across-at-least-nine-chains-what-trm-knows-now"},{"credibility":1,"name":"CoinDesk: Thorchain halts trading after $10 million cross-chain exploit","type":"news_article","url":"https://www.coindesk.com/tech/2026/05/15/thorchain-halts-trading-after-usd10-million-cross-chain-exploit-rune-token-drops-12"},{"credibility":1,"name":"CoinTelegraph: THORChain Halts Trading After ZachXBT Flags $10M Exploit","type":"news_article","url":"https://cointelegraph.com/news/thorchain-halts-trading-zachxbt-flags-10m-exploit"},{"credibility":2,"name":"CryptoTimes: $10.8 Million Drained: Inside the THORChain Exploit","type":"news_article","url":"https://www.cryptotimes.io/2026/05/17/10-8-million-drained-inside-the-thorchain-exploit-that-froze-cross-chain-defi-for-13-hours/"},{"credibility":2,"name":"CryptoTimes: THORChain Shares Exploit Report Revealing $10.7M Vault Breach","type":"news_article","url":"https://www.cryptotimes.io/2026/05/21/thorchain-shares-exploit-report-revealing-10-7m-vault-breach-by-new-node/"},{"credibility":2,"name":"CryptoNews: THORChain Co-Founder's Wallet Drained $1.35M in DPRK Telegram Scam","type":"news_article","url":"https://cryptonews.com/news/thorchain-co-founders-wallet-drained-1-35m-in-dprk-telegram-scam/"},{"credibility":1,"name":"CoinTelegraph Magazine: THORChain founder JP Thor vampire attack DeFi","type":"news_article","url":"https://cointelegraph.com/magazine/thorchain-founder-jp-thor-vampire-attack-defi/"},{"credibility":1,"name":"MIT Technology Review: Welcome to the dark side of crypto's permissionless dream","type":"news_article","url":"https://www.technologyreview.com/2026/02/18/1132587/jean-paul-thorbjornsen-dark-side-crypto-permissionless-dream/"},{"credibility":2,"name":"CryptoBriefing: Lazarus Group exploits ThorChain for $292M rsETH laundering","type":"news_article","url":"https://cryptobriefing.com/lazarus-group-exploits-thorchain-for-292m-rseth-laundering-operation/"},{"credibility":3,"name":"THORChain Lawsuit (creditor recovery site)","type":"other","url":"https://www.thorchainlawsuit.com/"}],"summary":"THORChain is a decentralized cross-chain liquidity protocol that enables native asset swaps across blockchains without wrapped tokens, using its RUNE token as settlement collateral. Since its mainnet launch, the protocol has suffered three significant exploit events totaling over $25 million in losses, became the primary laundering conduit for North Korea's Lazarus Group following the 2025 Bybit hack ($1.2 billion routed through the network), and its THORFi lending product collapsed in January 2025 with approximately $200 million in user funds frozen. The protocol faces ongoing legal action from creditors, has lost key developers over ethical disputes about blocking illicit transactions, and experienced a further $10.8 million vault breach in May 2026.","timeline":[{"date":"2018-01-01","event":"THORChain founded by John-Paul Thorbjornsen (JP Thor) and a team of five engineers; founder operates pseudonymously.","source":""},{"date":"2021-07-16","event":"First ETH Router exploit: approximately $5 million drained via Bifrost msg.value manipulation. THORChain treasury commits to compensate LPs.","source":"","source_url":"https://www.theblock.co/post/111660/thorchain-suffers-5-million-exploit-developers-have-put-out-a-fix"},{"date":"2021-07-23","event":"Second ETH Router exploit: approximately $8 million in ERC-20 tokens (ALCX, ETH, SUSHI, XRUNE, USDC, USDT, YFI) drained via the same Bifrost vulnerability class.","source":"","source_url":"https://www.coindesk.com/markets/2021/07/23/blockchain-protocol-thorchain-suffers-8m-hack"},{"date":"2022-06-01","event":"THORChain mainnet goes live after approximately four years of development.","source":"","source_url":"https://thorchain.org/"},{"date":"2024-01-01","event":"Founder John-Paul Thorbjornsen publicly reveals his identity after operating under a pseudonymous female persona ('Leena') since the project's inception.","source":"","source_url":"https://cointelegraph.com/magazine/thorchain-founder-jp-thor-vampire-attack-defi/"},{"date":"2025-01-23","event":"THORChain halts all THORFi savers and lending withdrawals, freezing approximately $209 million. Core contributor TCB publicly states the protocol is insolvent. RUNE falls 29%.","source":"","source_url":"https://decrypt.co/302688/defi-network-thorchain-200-million-debt-whats-going-on"},{"date":"2025-02-21","event":"Lazarus Group (DPRK) steals $1.4 billion from Bybit exchange and begins routing funds through THORChain. Approximately $1.2 billion (85% of stolen funds) ultimately transits the protocol.","source":"","source_url":"https://www.coindesk.com/tech/2025/04/07/the-blockchain-fueling-north-korea-s-massive-crypto-laundering-operation"},{"date":"2025-02-01","event":"Lead developer 'Pluto' resigns from THORChain after a community vote reverses a brief pause on ETH swaps linked to Lazarus Group transactions.","source":"","source_url":"https://www.ainvest.com/news/thorchain-developer-quits-north-korea-crypto-laundering-row-2502/"},{"date":"2025-04-07","event":"CoinDesk publishes in-depth investigation: 'Inside North Korea's Favorite Crypto Laundering Tool: THORChain.' Node operators earned at least $12 million in fees from Lazarus-linked transactions.","source":"","source_url":"https://www.coindesk.com/tech/2025/04/07/the-blockchain-fueling-north-korea-s-massive-crypto-laundering-operation"},{"date":"2025-05-19","event":"THORFi Recovery Group, represented by McDermott Will & Emery, announces potential legal action against THORChain and its principals over the $200M collapse.","source":"","source_url":"https://chainwire.org/2025/05/19/thorchain-faces-legal-action-over-200m-collapse-amid-alleged-mismanagement-and-insolvency/"},{"date":"2025-12-01","event":"RUNE token reaches five-year low of approximately $0.574, having declined over 80% during 2025.","source":"","source_url":"https://www.thecryptoupdates.com/thorchain-faces-insolvency-claims-amid-26-price-drop-a-lesson/"},{"date":"2026-05-15","event":"Multi-chain vault exploit drains $10.8 million across nine blockchains via malicious validator node exploiting GG20 TSS key reconstruction. ZachXBT flags the exploit in real time. Network halted for 13 hours. RUNE drops 10-12%.","source":"","source_url":"https://www.trmlabs.com/resources/blog/thorchain-exploit-drains-usd-11m-across-at-least-nine-chains-what-trm-knows-now"},{"date":"2026-05-21","event":"THORChain publishes post-incident exploit report identifying the malicious validator node address and reconstruction attack method.","source":"","source_url":"https://www.cryptotimes.io/2026/05/21/thorchain-shares-exploit-report-revealing-10-7m-vault-breach-by-new-node/"}]},"v":1}